21 CFR Part 11 Labeling Systems: Sharing Our Practical Experience
Everyone in the biotech and life sciences industries knows that 21 CFR Part 11 is not a new requirement � it dates back to 1997, and has remained pretty much unchanged since then. Only its scope has changed.
Initially, the new requirement was widely ignored by both the industry and the FDA. This indifference was not intentional, but can be attributed to a pure lack of understanding by both the industry and the regulators. More recently the understanding of the rule has become more widespread within both regulated companies and the regulators. This is mainly thanks to organizations like GAMP and ISPE. There has been significant clarification of the requirements published by the FDA and, of course, there have been detailed warning letters published on the FDA�s web page. This article is based upon practical experience from numerous 21 CFR Part 11 compliance projects that our company has performed, and through information culled from our customers in consultation with the regulators.
Based on trends over the past five years, one can see that there are still three main areas where labeling projects can go wrong: supplier based, customer based and application based problems.
1. Supplier Based Problems
The main supplier based problem is the failure to fully appreciate the scale of the task when assisting a customer in implementing a compliant system. Lead times can be unpredictable, as time factored in for such things as documentation approval can easily be eaten up by clarification of points contained in the User Requirement (URS) and/or Functional Specification (FS) documents. We have learned that it�s more cost effective to schedule a comprehensive face to face meeting to discuss the application requirements as detailed in the customer�s URS document, rather than assuming our interpretation is the same as the customer�s. This type of approach also makes sense for the review of the FS document, and has actually saved money for both customer and supplier.
This approach has also highlighted the need for supplementary software tools to be included by the supplier or to be made available by the customer, instead of this fact being realized during the implementation phase.
When a new project is sanctioned, there is a customer tendency to ask for lots of �nice to have�s� (but not essential) features. This can be seen as a golden opportunity by the supplier to make the project as large and custom as possible; however, we have once again learned from our experience to question the need for each and every piece of customization requested. Failing to take this approach increases the risk of a custom solution being developed for each customer instead of a generic solution being tailored to suit individual customers� needs. This situation should be avoided, because even if the custom solution meets an organization�s requirements today, it�s unlikely to meet future requirements unless a complete 5-10 year plan has been realized.
21 CFR Part 11 compliant labeling projects whether for Pharmaceutical or Medical Device Manufacturers can be quite large and time consuming, which usually results in a dramatically varying workload situation for the supplier. The net result is that a delivery period can be quoted with all the best intentions by the supplier, yet the actual delivery period will depend upon the supplier�s workload at the time of order placement. This becomes even more difficult for the supplier to manage as the project progresses because the internal resources may not be available at the right time to catch up any time lost due slow document approval or delayed functionality decisions.
2. Customer Based Problems
As an old saying goes, there are always two sides to a story � and this is the case with labeling systems. Customers are also a source of problems when implementing new labeling systems. The main customer based cause of disruption is the failure to investigate their own requirements fully or a failure to pass enough detail to the supplier. Invariably, the review of the URS or FS documents with our customer leads to the customer realizing there is more to 21 CFR Part 11 compliance than they initially thought. The systems feeding data to the labeling program should also be considered for 21 CFR Part 11 investigation and compliance. The use of databases is a typical area where the compliance of the labeling system can fall down. Most databases used by customers to populate the labeling system do not have an electronic signature associated with a new record entry or a modification of an existing record. A solution needs to be incorporated to solve this problem, and that often comes as a surprise to the customer.
In the past, most labeling systems were simple standalone systems that were supported by SOPs and paper based records. Today, this is not the case as 21 CFR Part 11 compliance has forced labeling software developers to move towards client/server type systems. Such systems now require much more effort on the part of the customer to maintain control over the system. For example, user permissions and passwords need to be handled for current and former users of the system. The system architecture also needs to be documented and controlled by the customer. This sounds easy enough, but one recent customer who kept this information in an electronic form found out this type of record is also covered by 21 CFR Part 11. The program being used to create the record was not 21 CFR Part 11 compliant, and the compliance exercise failed.
It has come to our attention that 21 CFR Part 11 compliance projects involving labeling systems have a heavy reliance upon customers� IT teams during the specification and installation phases. It is very important that these people are suitably trained in cGMP procedures to ensure any planned activity is in line with the current regulatory requirements. If a third party service provider is being used for this activity, then once again, their own staff should receive cGMP training. This subject has also been highlighted in recent FDA warning letters.
3. Application Based Problems
Surprisingly, compliant labelling problems can often occur at the application level. A typical problem often occurs when data entered at a local printer keypad is not recorded, thus making it impossible to produce a complete and accurate electronic record of what was actually printed. Data entry to standalone printers or PCs cannot usually be accepted, which has severe implications for many existing Print & Apply systems and causes a great deal of discussion and re-thinking.
The typical print room environment in a Life Sciences environment which may have several operators using several different print stations is no longer practical as the password entered at print time may not match the password that was used when the system was started. Closing the application and restarting it for each different user every few minutes is not a workable solution. Our solution to this problem is to recommend the use of a biometric mouse, thus negating the need to seek a typed password when making a new electronic print record.
To our surprise, this solution led to lengthy conversations about how much of the users thumbprint is scanned while using the mouse, and how this record itself was stored. Some customers and individual users were concerned with the thought of their thumbprint being scanned and stored electronically, fearing the system could lead to misuse and abuse in areas outside the labeling system. In reality, most biometric mice devices take a snapshot of two or three points on the thumbprint and assign coordinates to them. The thumbprint is not actually stored, just the expected image at each of the coordinates selected. The master coordinate and image details are compared with the user�s thumbprint on the biometric mouse each time a signature is requested. This way it is impossible to reproduce the original thumbprint. Users, as a result, have greater confidence in the system and the solution is now generally accepted on this basis.
In some instances, the label production rate can be adversely affected by the need to record an electronic signature for each different label printed. This can be a problem, especially where the batch quantities are very small. Applications involving clinical trials labels can be a particular problem as every label can potentially be different and a signature for each different label is not practical. Coding changes can be made to print a batch of labels based upon a treatment group and get a reconciliation label with just a single signature entry.
Another application based problem occurs when a label print request is actioned, electronically signed and recorded, but the labels do not get printed due to a printer problem. The original record usually cannot be modified or deleted by a print operator, yet the labels are still required. Until recently, a customer procedure was needed to provide a documented solution to this occurrence. Now, as a result of this experience, you�ll see a label reconciliation tool added to the standard labeling program. This allows the occurrence and the corrective action taken to be recorded, thus the true picture is always known.
Data integrity and data migration have also become important points to be considered on 21 CFR Part 11 compliance projects. Most applications that feed data to the labeling system are usually themselves non compliant. Thus, care needs to be taken when making use of such data. In practice, companies should strive to reproduce a function provided by something like Excel within its own compliant application to help solve this problem. This process means companies are in control of their own destiny and can offer customers a high degree of reassurance concerning compliance. Data integrity has been the subject of many recent FDA warning letters, particularly with reference to non 21 CFR Part 11 compliance. Data migration can also be a problem as simply importing data from another source often means this data is unchecked or unapproved. It is possible to import data, make it secure and approve it for label production use � but this can be time consuming. To help reduce the scale of the task, companies should remove redundant data before any migration is considered.
Another point to consider is that FDA warning letters are also becoming more frequent in the area of network architecture and its lack of consideration when it comes to validation or 21 CFR Part 11 compliance. The FDA has recognized that keeping control of the relevant network architecture is important to ensure the integrity of the system in question. Companies should ensure that network plans are available and that they are kept up to date.
Validation should prove that any critical data can be safely moved around the network and that, where automated data retrieval systems are involved, tests should be done to prove that in the event of a failure the system fails safe.
Conclusion
Replacement of existing labeling systems is a much larger and more involved task than previously thought, although by choosing the correct vendor, there are ways to make the project easier to manage and also to ensure an FDA 483 warning letter is not still issued once an audit is performed. Current labeling practices need to change in most pharmaceutical and medical organizations due to the wide ranging scope of 21 CFR Part 11. Choosing the correct supplier and working closely with them is important to ensure a smooth transition between labeling systems.
